But I can't rule out the possibility that the remote filename might contain shell metacharacters.

My immediate thought was, "No problem, I'm sure the CPAN has six different modules for escaping shell metacharacters," but all I seem to be able to find is modules that appear to be intended for escaping strings in program source code (notably, String::Escape) or undoing said escaping (Encode::Escape for instance). To the best of my knowledge, those probably won't do entirely the right thing (e.g., with spaces). Am I correct in assuming that I need something different?

The characteristics of the remote system are known, and are essentially the same as the local system, although they get updates at different times. (Both systems are Debian.)

In my particular situation, actively malicious filenames are very unlikely to occur (and if they do, it implies that I have much bigger problems than this program can possibly address or even meaningfully exacerbate).

However, I still don't want the thing to fail to work correctly if a filename happens for some reason to contain quotation marks.

When putting a smiley right before a closing parenthesis, do you:

Use two parentheses: (Like this: :) )
Use one parenthesis: (Like this: :)
Reverse direction of the smiley: (Like this: (: )
Use angle/square brackets instead of parentheses
Use C-style commenting to set the smiley off from the closing parenthesis
Make the smiley a dunce: (:>
I disapprove of emoticons
Other